WordPress Plugin Vulnerabilities

TranslatePress < 3.3.3 - Unauthenticated Privilege Escalation

Description

The plugin is vulnerable to Privilege Escalation due to insufficient restriction on the capabilities a user may grant themselves. This makes it possible for unauthenticated attackers to elevate their privileges beyond those intended for their role.

Affects Plugins

Plugin icon
translatepress-multilingual
Fixed in 3.3.3

References

CVE
CVE-2026-78267
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/fe6f569f-0b4d-4530-b2b2-37e92b03d45a

Classification

Type
PRIVESC
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-269
CVSS
7.3 (high)

Miscellaneous

Original Researcher
ChuongVN
Verified
No
WPVDB ID
74e5fbee-0978-496f-8c44-3daf3f2607ea

Timeline

Publicly Published
2026-08-24 (about 1 month ago)
Added
2026-09-10 (about 1 month ago)
Last Updated
2026-09-10 (about 1 month ago)

Other

Published
Title
Published
2026-08-05
Title
PublishPress Capabilities: User Role Access Control, Admin Area Permissions < 2.50.0 - Authenticated (Editor+) Privilege Escalation
Published
2020-06-10
Title
Brizy - Page Builder < 1.0.126 - Improper Access Controls on AJAX Calls
Published
2026-07-07
Title
多说社会化评论框 <= 1.2 - Unauthenticated Privilege Escalation via api.php 'option'/'value' Parameters
Published
2023-12-26
Title
Ultimate Addons for Beaver Builder < 1.35.15 - Contributor+ Privilege Escalation
Published
2025-01-20
Title
WordPress Easy Real Estate Plugin < 2.3.0 - Privilege Escalation